CVE-2009-2902: apache tomcat

Modified

AliasesGHSA-8wch-9gcg-v2pr

Published 28-01-2010Last modified 07-08-2024

Vulnerability summary

CVE-2009-2902 is a medium (CVSS 4.3) vulnerability in apache tomcat. EPSS estimates a 10.74% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

10.74%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5

DSA-2207-1 RHSA-2010:0119 RHSA-2010:0580 RHSA-2010:0582 RHSA-2010:0693

Timeline

28-01-2010
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

10.74%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 10.74% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Apache1 product

tomcatEOL5.5.0 | 5.5.1 | 5.5.2 | 5.5.3 | 5.5.4 | 5.5.5 | 5.5.6 | 5.5.7 | 5.5.8 | 5.5.9 | 5.5.10 | 5.5.11 | 5.5.12 | 5.5.13 | 5.5.14 | 5.5.15 | 5.5.16 | 5.5.17 | 5.5.18 | 5.5.19 | 5.5.20 | 5.5.21 | 5.5.22 | 5.5.23 | 5.5.24 | 5.5.25 | 5.5.26 | 5.5.27 | 5.5.28 | 6.0 | 6.0.0 | 6.0.1 | 6.0.2 | 6.0.3 | 6.0.4 | 6.0.5 | 6.0.6 | 6.0.7 | 6.0.8 | 6.0.9 | 6.0.10 | 6.0.11 | 6.0.12 | 6.0.13 | 6.0.14 | 6.0.15 | 6.0.16 | 6.0.17 | 6.0.18 | 6.0.19 | 6.0.20

Org.apache.tomcat1 product

tomcat≥ 5.5.0, < 5.5.29 | ≥ 6.0.0, < 6.0.24

2 vendors · 2 products

References

75 links

securitytracker.com/id?1023504VDB EntryX Refsource SECTRACK
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113Vendor AdvisoryX Refsource HP
marc.info?l=bugtraq&m=127420533226623&w=2Vendor AdvisoryX Refsource HPWEB
svn.apache.org/viewvc?rev=892815&view=revX Refsource CONFIRMWEB
secunia.com/advisories/39317Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19431VDB EntrySignatureX Refsource OVAL
www.securityfocus.com/archive/1/509150/100/0/threadedMailing ListX Refsource BUGTRAQ
www.debian.org/security/2011/dsa-2207Vendor AdvisoryX Refsource DEBIANWEB
lists.opensuse.org/opensuse-updates/2012-12/msg00089.htmlVendor AdvisoryX Refsource SUSEWEB
marc.info?l=bugtraq&m=136485229118404&w=2Vendor AdvisoryX Refsource HPWEB

Show all 75 references

secunia.com/advisories/40330Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2010:177Vendor AdvisoryX Refsource MANDRIVAWEB
secunia.com/advisories/43310Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2010/1559VDB EntryX Refsource VUPEN
lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlVendor AdvisoryX Refsource APPLEWEB
marc.info?l=bugtraq&m=133469267822771&w=2Vendor AdvisoryX Refsource HPWEB
www.vupen.com/english/advisories/2010/1986VDB EntryX Refsource VUPEN
www.redhat.com/support/errata/RHSA-2010-0580.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/40813Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/38541Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2010:176Vendor AdvisoryX Refsource MANDRIVAWEB
tomcat.apache.org/security-6.htmlX Refsource CONFIRMWEB
secunia.com/advisories/57126Third Party AdvisoryX Refsource SECUNIA
www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.htmlX Refsource CONFIRMWEB
ubuntu.com/usn/usn-899-1Vendor AdvisoryX Refsource UBUNTUWEB
support.apple.com/kb/HT4077X Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.htmlVendor AdvisoryX Refsource SUSEWEB
lists.opensuse.org/opensuse-updates/2013-01/msg00037.htmlVendor AdvisoryX Refsource SUSEWEB
secunia.com/advisories/38687Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/38346Third Party AdvisoryX Refsource SECUNIA
tomcat.apache.org/security-5.htmlX Refsource CONFIRMWEB
www.vmware.com/security/advisories/VMSA-2011-0003.htmlX Refsource CONFIRMWEB
www.securityfocus.com/bid/37945VDB EntryX Refsource BID
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7092VDB EntrySignatureX Refsource OVAL
www.redhat.com/support/errata/RHSA-2010-0119.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/support/errata/RHSA-2010-0582.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/38316Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/516397/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2010/0213VDB EntryX Refsource VUPEN
marc.info?l=bugtraq&m=139344343412337&w=2Vendor AdvisoryX Refsource HPWEB
svn.apache.org/viewvc?rev=902650&view=revX Refsource CONFIRMWEB
exchange.xforce.ibmcloud.com/vulnerabilities/55857VDB EntryX Refsource XFWEB
lists.opensuse.org/opensuse-updates/2012-12/msg00090.htmlVendor AdvisoryX Refsource SUSEWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
nvd.nist.gov/vuln/detail/CVE-2009-2902Advisory
github.com/apache/tomcat/commit/3e1010b1a2f648581fac3d68afbf18f2979f6bf6WEB
github.com/apache/tomcat55/commit/0299cb724ea71f304d54adfcdb950f59b01fb421WEB
web.archive.org/web/20150308000602/http://www.securityfocus.com/archive/1/509150/100/0/threadedWEB
web.archive.org/web/20140515000000*/http://secunia.com/advisories/57126WEB
web.archive.org/web/20121211195847/http://www.securityfocus.com/bid/37945WEB
web.archive.org/web/20121211115829/http://securitytracker.com/id?1023504WEB
web.archive.org/web/20111119150528/http://www.securityfocus.com/archive/1/516397/100/0/threadedWEB
web.archive.org/web/20110601000000*/http://secunia.com/advisories/40330WEB
web.archive.org/web/20110529135656/http://secunia.com/advisories/38541WEB
web.archive.org/web/20110213053623/https://secunia.com/advisories/43310WEB
web.archive.org/web/20100601000000*/http://secunia.com/advisories/40813WEB
web.archive.org/web/20100412065745/http://secunia.com/advisories/39317WEB
web.archive.org/web/20100329100145/http://secunia.com/advisories/38687WEB
web.archive.org/web/20100127190258/http://secunia.com/advisories/38316WEB
web.archive.org/web/20100127015355/http://secunia.com/advisories/38346WEB
support.hpe.com/hpesc/public/docDisplay?docId=c02241113WEB
support.apple.com/kb/HT4077WEB
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7092WEB
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:19431WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
github.com/apache/tomcatPACKAGE
access.redhat.com/errata/RHSA-2010:0582WEB
access.redhat.com/errata/RHSA-2010:0580WEB
access.redhat.com/errata/RHSA-2010:0119WEB